fix: grant S3 permissions to Role instead of ManagedPolicy

The grant_read_write() method was incorrectly called with a ManagedPolicy
instead of a Role. ManagedPolicy does not implement IGrantable and cannot
be used as a Principal in IAM policies. This latent bug was exposed when
CDK 2.174.0 added validation that rejects ManagedPolicy as a principal.

The fix moves the grant call to after the Role is created and targets
the model_execution_role instead of model_execution_policy, aligning
with the pattern used elsewhere in this file and other sagemaker modules.

Fixes: Cannot use a ManagedPolicy as the 'Principal' in an IAM Policy

Author: weklund

modules/sagemaker/sagemaker-templates/templates/model_deploy/seed_code/deploy_app/deploy_app/deploy_endpoint_stack.py

@@ -134,7 +134,6 @@ def __init__(
         )
 
         model_bucket = s3.Bucket.from_bucket_arn(self, "ModelBucket", MODEL_BUCKET_ARN)
-        model_bucket.grant_read_write(model_execution_policy)
 
         if ECR_REPO_ARN:
             model_execution_policy.add_statements(
@@ -152,6 +151,9 @@ def __init__(
             managed_policies=[model_execution_policy],
         )
 
+        # Grant S3 read/write permissions to the role (not the ManagedPolicy)
+        model_bucket.grant_read_write(model_execution_role)
+
         # setup timestamp to be used to trigger the custom resource update event to retrieve
         # latest approved model and to be used with model and endpoint config resources' names
         now = datetime.now().replace(tzinfo=timezone.utc)